* search.c: Integer overflow fixes

(Freplace_match): Use ptrdiff_t, not int, for indexes that can
exceed INT_MAX.  Check that EMACS_INT value is in range before
assigning it to the (possibly-narrower) index.
(match_limit): Don't assume that a fixnum can fit in 'int'.

diff --git a/src/ChangeLog b/src/ChangeLog
index cbd8cd2c219340b6a02c174da0640aa779aa0799..101fa7ceab78624f97c5a1bfc55af1df94cc6d5a 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,11 @@
 2011-09-04  Paul Eggert  <eggert@cs.ucla.edu>
 
+       * search.c: Integer overflow fixes
+       (Freplace_match): Use ptrdiff_t, not int, for indexes that can
+       exceed INT_MAX.  Check that EMACS_INT value is in range before
+       assigning it to the (possibly-narrower) index.
+       (match_limit): Don't assume that a fixnum can fit in 'int'.
+
        * print.c: Integer overflow fix.
        (print_object): Use ptrdiff_t, not int, for index that can
        exceed INT_MAX.

diff --git a/src/search.c b/src/search.c
index d892792cbaa348b38783d7350d6d31772b6c6122..b3d67e6c4313189751e1bdb67fc49522c0b53b74 100644 (file)
--- a/src/search.c
+++ b/src/search.c
@@ -2404,7 +2404,7 @@ since only regular expressions have distinguished subexpressions.  */)
   int some_uppercase;
   int some_nonuppercase_initial;
   register int c, prevc;
-  int sub;
+  ptrdiff_t sub;
   EMACS_INT opoint, newpoint;
 
   CHECK_STRING (newtext);
@@ -2423,9 +2423,9 @@ since only regular expressions have distinguished subexpressions.  */)
   else
     {
       CHECK_NUMBER (subexp);
-      sub = XINT (subexp);
-      if (sub < 0 || sub >= search_regs.num_regs)
+      if (! (0 <= XINT (subexp) && XINT (subexp) < search_regs.num_regs))
        args_out_of_range (subexp, make_number (search_regs.num_regs));
+      sub = XINT (subexp);
     }
 
   if (NILP (string))
@@ -2662,7 +2662,7 @@ since only regular expressions have distinguished subexpressions.  */)
          unsigned char str[MAX_MULTIBYTE_LENGTH];
          const unsigned char *add_stuff = NULL;
          ptrdiff_t add_len = 0;
-         int idx = -1;
+         ptrdiff_t idx = -1;
 
          if (str_multibyte)
            {
@@ -2813,7 +2813,7 @@ since only regular expressions have distinguished subexpressions.  */)
 static Lisp_Object
 match_limit (Lisp_Object num, int beginningp)
 {
-  register int n;
+  EMACS_INT n;
 
   CHECK_NUMBER (num);
   n = XINT (num);